Why It Is Impossible To Recover Data From An Overwritten Hard Drive [Technology Explained]

posted on September 20, 2011 by Tina Sieber

recover data from overwritten hard drive Recovering deleted data from a hard drive is generally possible because typically the actual data is not deleted. Instead, information about where the data is stored is removed. In this article I will explain how data is stored on a hard drive, what happens when files are deleted, what formatting a hard drive does, and why it is impossible to recover files after they were overwritten.

The article outlines how data is stored on the physical level, which is essential to understanding why it can not be restored after being overwritten. If you are interested in the organizational structure of a hard drive, i.e. how the storage of files is managed, please read the article What A File System Is & How You Can Find Out What Runs On Your Drives. For more information on how to recover deleted files, see the resources at the bottom of this article.

How Is Information Stored Digitally?

Digital information is stored in bytes. Each byte contains 8 bits. Each bit has a value, which is either 0 or 1. This way of storing data is called theÂ binary numeral system as it uses two symbols, i.e. 0 and 1. Subsequently, any data stored on a computer is written in the binary code, which is a string of 0s and 1s.

recover data from overwritten hard drive

How Do Hard Drives Store Information?

Information on hard disk drives (HDDs) is stored magnetically and non-volatile, meaning no power is required to maintain the stored information. Every magnet has a plus (+) and a minus (-) pole, which equals two values and thus allows it to represent the binary code. The HDD storage unit or platter contains a ferromagnetic surface, which is subdivided into small magnetic regions, called magnetic domains. HDDs store data by directional magnetization of magnetic domains. Each magnetic domain can be magnetized in one of two possible directions and subsequently represents one of two values: 0 or 1.

recover deleted files

There are two different technologies for recording data on a HDD. Prior to 2005, the recording layer was oriented parallel to the disk surface (horizontally), meaning the binary code was represented by directional left vs. right magnetization (longitudinal recording). At around 2005 a new technology was introduced and data was written by magnetizing segments vertically, i.e. up vs. down (perpendicular recording). This allowed closer magnetic domain spacing and also enabled larger storage capacities.

recover deleted files

How Is Data Stored In Random Access Memory (RAM)?

Essentially, data is stored the same way as on a hard drive, i.e. in binary code. The major difference is that this type of storage is volatile, meaning any stored information is lost as soon as power is removed. A RAM is made up of integrated circuits, which in turn contain capacitors and transistors. Each capacitor stores one bit of data. The state of the capacitor can either be charged or discharged, i.e. 1 or 0, representing the binary code.

recover deleted files

What Happens When Data Is Deleted?

In a RAM module, the organizational structure is very flat. When data is removed from memory, the actual information vanishes instantly. Also, when power is lost, the capacitors quickly discharge and hence all information is lost.

The situation on a HDD is completely different as information is stored in two ways. First, data is stored physically on the magnetic hard drive. Secondly, all stored data is managed by a file system, which creates an information table revealing the exact location of data, i.e. where on the hard drive a certain file is stored. This is necessary because one file can be stored in different locations across the hard drive. The operating system then uses this table to locate files and put together the pieces of large files.

computer file system

When a file is deleted, typically only the information stored in the file systemâ€™s table is removed. Since it would take too long to delete the actual file, the physical location of the data remains untouched. When the operating system wants to store new files, however, it consults the table for available space. Since the location of the deleted files was marked as vacant, the operating system may then write new data over the old data, which terminally deletes that information.

For details on how the file system works and how it organizes and manages hard drives, see my article What A File System Is & How You Can Find Out What Runs On Your Drives.

What Happens When A HDD Is Formatted?

The type of formatting that most users are familiar with is called high-level formatting and it is the process of setting up an empty file system. Since it does not require scanning the hard drive for defects, it is also called quick formatting.

Typically, data stored on the hard drive is not physically deleted during formatting. What does happen is that the file system is set up from scratch, meaning the hard drive is re-organized and the table with information where files are stored is reset. As long as the file system and its settings remain the same, none of the actual data previously stored on the hard drive is deleted or overwritten and can subsequently be recovered.

What Happens When Data Is Overwritten?

When data is overwritten, the magnetic domains on the HDD are re-magnetized. This is an irreversible process that physically removes information previously stored in this location. While some residual physical traces of the changes (or none changes) in magnetization potentially remain, which may theoretically allow a partial restore, this would require the use of a magnetic force microscope or similar technologies, none of which have been shown to recover data successfully so far [although you never know what's going on in secret government intelligence labs]. So in essence, there is no software or other technical way known to the public that can restore overwritten data.

recover data from overwritten hard drive